icedid | b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b | Triage

Analysis

max time kernel
188s
max time network
252s
platform
windows7_x64
resource
win7-20220414-en
submitted
20-05-2022 22:43

Sharing

Report Analysis Logs

General

Target

b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b.exe
Size

382KB
MD5

0ef3890b051c62c04435a5ab8cb15ec2
SHA1

c810007de17fe76f2fca134d0a1003c790a616d9
SHA256

b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b
SHA512

e56f43ae5a2c19f1e5b74ab5018821257aac3a5d94daa2c656d6181d33250acfed04f48d7bd678ab946d7eb48204760cb488a24f3503919b13ea7438bd1f2bc0

Score

10^/10

icedid banker loader trojan

Malware Config

Extracted

Family

icedid

C2

wloppyload.top

Signatures

IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
trojan banker icedid

IcedID First Stage Loader 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/828-55-0x0000000000490000-0x0000000000496000-memory.dmp	IcedidFirstLoader
behavioral1/memory/828-58-0x0000000000480000-0x0000000000483000-memory.dmp	IcedidFirstLoader

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b.exe

pid	process
828	b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b.exe
828	b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b.exe

C:\Users\Admin\AppData\Local\Temp\b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b.exe
"C:\Users\Admin\AppData\Local\Temp\b9ce680718abab18162d7358dd9717276d4d77674f699aac9f7dfc3dc2e9115b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-54-0x00000000754A1000-0x00000000754A3000-memory.dmp

Filesize
8KB

Download
memory/828-55-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/828-58-0x0000000000480000-0x0000000000483000-memory.dmp

Filesize
12KB

Download